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AMENDMENTS TO THE CLAIMS 

1 . (Currently amended) A data processing method including receiving input data 
containing a plurality of instruction codes, and judging whether or not a process executed based 
on the instruction codes contained in the received data is a malicious process, said method 
comprising: 

retrieving an instruction code related to a branch instruction from the data; 
reading one byte of the data; 

judging whether a branch destination address associated with a branch destination is 
larger than a branch origin address based only on the one byte of the data read: 

storing Qrthe branch origin address associated with the retrieved instruction code and a-the 
branch destination address associated with a-the branch destination of the instruction cod e when 
the branch destination address associated with the branch destination is judged to be larger than 
the branch origin address: 

judging whether or not an instruction code for calling an instruction code group for 
executing a predetermined process is associated with the branch destination address; 

storing a call destination address of the instruction code if the instruction code is 
associated with the branch destination address; 

judging whether or not the stored call destination address is between the branch origin 
address and the branch destination address; and 

concluding that the process executed based on the instruction codes contained in the data 

is a malicious process, when the instruction code for calling the instruction code group for 

executing the predetermined process is associated with the branch destination address and the 
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call destination address of the instruction code is between the branch origin address and the 
branch destination address. 



2. (Currently amended) A data processor including means for receiving input data 

containing a plurality of instruction codes, forjudging whether or not a process executed based 
on the instruction codes contained in the received data is a malicious process, said data processor 
comprising: 

means for retrieving an instruction code related to a branch instruction from the data; 
means for reading one byte of the data: 

means for judging whether a branch destination address associated with a branch 
destination is larger than a branch origin address based only on the one byte of the data read; 

means for storing a-the branch origin address associated with the retrieved instruction 
code and a-the branch destination address associated with a-the branch destination of the 
instruction cod e when the branch destination address associated with the branch destination is 
judged to be larger than the branch origin address ; 

means forjudging whether or not an instruction code for calling an instruction code 
group for executing a predetermined process is associated Avith the branch destination address; 

means for storing a call destination address of the instruction code if the instruction code 
is associated with the branch destination address; and 

means forjudging whether or not the stored call destination address is between the 
branch origin address and the branch destination address, wherein 
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it is concluded that the process executed based on the instruction codes contained in the 
data is a maUcious process, when the instruction code for caUing the instruction code group for 
executing the predetermined process is associated with the branch destination address and the 
call destination address of the instruction code is between the branch origin address and the 
branch destination address. 

3. (Currently amended) The data processor as set forth in claim 2, further comprising 
means forjudging whether or not a predetermined character string is associated with a return 
address of the instruction code group, wherein if the character string is associated with the return 
address, the information indicating that the data is data for executing a malicious process is 
oulputted. 

4. (Currently Amended) A data processor including means for receiving input data 
containing a plurality of instruction codes, forjudging whether or not a process executed based 
on the instruction codes contained in the data received by the means is a malicious process, said 
data processor comprising: 

means for retrieving an instruction code for calling an instruction code group for 
executing a predetermined process from the data; and 
means for reading one byte of the data: 

means for judging whether a branch destination address associated with a branch 
destination is larger than a branch origin address based only on the one bvte of the data read; 
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means for storing the branch origin address associated with the retrieved instruction code 
and the branch destination address associated with the branch destination of the instruction code 
when the branch destination address associated with the branch destination is judged to be larger 
than the branch origin address: 

means forjudging whether or not a predetermined character string is associated with a 
return address of the instruction code group, wherein 

it is concluded that the process executed based on the instruction codes contained in the 
data is a malicious process, when the instruction code for calling the instruction code group for 
executing the predetermined process is in the data and the predetermined character string is 
associated with the return address of the instruction code group. 

5. (Currently Amended) A data processor including means for receiving input data 
containing a plurality of instruction codes, forjudging whether or not a process executed based 
on the instruction codes contained in the data received by the means is a malicious process, said 
data processor comprising: 

means for retrieving an instruction code for calling an instruction code group for 
executing a predetermined process from the data; 

means for reading one byte of the data; 

means for judging whether a branch destination address associated with a branch 
destination is larger than a branch origin address based only on the one byte of the data read: 

means for storing the branch origin address associated with the retrieved instruction code 
and the branch destination address associated with the branch destination of the instruction code 
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when the branch destination address associated wilfa the branch destination is iudged to be larger 
than the branch origin address ; and 




means forjudging whether or not an instruction code for obtaining a return address of the 
instruction code group is contained in the instruction code group if the instruction code is 
retrieved, wherein 

it is concluded that the process executed based on the instruction codes contained in the 
data is a malicious process, when the instruction code for calling the instruction code group for 
executing the predetermined process is in the data and the instruction code for obtaining the 
return address of the instruction code group is contained in the instruction code group, 

6. (Canceled) 

7. (Currently Amended) A computer-readable memory product storing a computer 

program including causing a computer to judge whether or not a process executed based on input 
data containing a plurality of instruction codes is a malicious process, the stored computer 
program comprising: 

causing the computer to retrieve an instruction code related to a branch instruction from 
the data; 

causing the computer to read one byte of the data: 

causing the computer to judge whether a branch destination address associated with a 
branch destination is iM-ger than a branch origin address based only on the one bvte of the data 
read: 
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causing the computer to store a -the b ranch origin address associated with the retrieved 
instruction code and ft-the branch destination address associated with ft-the branch destination of 
the instruction cod e when the branch destination address associated with the branch destination 
is judged to be larger than the branch origin address : 

causing the computer to judge whether or not an instruction code for calling an 
instruction code group for executing a predetermined process is associated with the branch 
destination address; 

causing the computer to store a call destination address of the instruction code if the 
instruction code is associated with the branch destination address; 

causing the computer to judge whether or not the stored call destination address is 
between the branch origin address and the branch destination address; and 

causing the computer to conclude that the process executed based on the instruction 
codes contained in the data is a malicious process, when the instruction code for calling the 
instruction code group for executing the predetermined process is associated with the branch 
destination address and the call destination address of the instruction code is between the branch 
origin address and the branch destination address. 

8, (Currently Amended) A data processor comprising: 

an input unit for inputting data containing a plurality of instruction codes; 

a storing unit for storing the data input by the input unit; and 

a controller capable of performing operations of; 
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retrieving an instruction code related to a branch instruction from the data stored 
in the storing unit; 

reading one byte of the data: 

judging whether a branch destination address associated with a branch destination 
is larger than a branch origin address based only on the one byte of the data read: 

storing a-the branch origin address associated with the retrieved instruction code 
and a-the branch destination address associated with arthe branch destination of the instruction 
code in the storing uni t when the branch destination address associated with the branch 
destination is judged to be larger than the branch origin address : 

judging whether or not an instruction code for calling an instruction code group 
for executing a predetermined process is associated with the branch destination address; 

storing a call destination address of the instruction code in the storing unit if the 
instruction code is associated with the branch destination address; 

judging whether or not the stored call destination address is between the branch 
origin address and the branch destination address; and 

concluding that the process executed based on the instruction codes contained in 
the data is a malicious process, when the instruction code for calling the instruction code group 
for executing the predetermined process is associated with the branch destination address and the 
call destination address of the instruction code is between the branch origin address and the 
branch destination address. 
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9. (Currently Amended) A data processor comprising: 

an input unit for inputting data containing a plurality of instruction codes; 

a storing unit for storing the data input by the input unit; and 

a controller capable of performing operations of; 

retrieving an instruction code for calling an instruction code group for executing a 
predetermined process from the data; 

reading one byte of the data; 

judging whether a branch destination address associated with a branch destination 
is larger than a branch origin address based only on the one byte of the data read; 

storing the branch origin address associated with the retrieved instruction code 
and the branch destination address associated with the branch destination of the instruction code 
when the branch destination address associated with the branch destination is judged to be larger 
than the branch origin address ; 

judging whether or not a predetermined character siring is associated with a return 
address of the instruction code group; and 

concluding that the process executed based on the instruction codes contained in 
the data is a malicious process, when the instruction code for calling the instruction code group 
for executing the predetermined process is in the data and the predetermined character string is 
associated with the return address of the instruction code group. 



10. (Currently Amended) A data processor: comprising: 

an input unit for inputting data containing a plurality of instruction codes; 
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a storing unit for storing the data input by the input unit; and 
a controller capable of performing operations of; 

retrieving an instruction code for calling an instruction code group for executing a 
predetermined process from the data; 

reading one byte of the data: 

judging whether a branch destination address associated with a branch destination 
is larger than a branch origin address based only on the one byte of the data read: 

storing the branch origin address associated with the retrieved instruction code 
and the branch destination address associated with the branch destination of the instruction code 
when the branch destination address associated witihi the branch destination is judged to be larger 
than the branch origin address: 

judging whether or not an instruction code for obtaining a return address of the 
instruction code group is contained in the instruction code group if the instruction code is 
retrieved; and 

concluding that the process executed based on the instruction codes contained in 
the data is a malicious process, when the instruction code for calling the instruction code group 
for executing the predetermined process is in the data and the instruction code for obtaining the 
return address of the instruction code group is contained in the instruction code group. 

1 1 . (Previously presented) The data processing method according to claim 1 , wherein 
the malicious process causes an erroneous operation in the process executed based on the 
instruction codes contained in the received data. 
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